Human Centric Defense vs Agentic Attacker

About this episode

Rafal Los talks with Mehul Revankar, co-founder and CPO of Quantro Security, about what happens when the attacker is an AI agent instead of a person. Mehul shares results from Quantro's research: AI agents exploited 72% of the roughly 3,000 disclosed vulnerabilities they tried. The average exploit cost under $3 in tokens and took about 11 minutes. Most exploits ran with no human involved, and nearly a quarter worked on the first try. They talk about why metrics built around human attackers, like EPSS and "is it exploited in the wild?", lose their meaning when compute is the only limit. They also cover how compensating controls and shrinking your attack surface buy defenders time, what happens to decades of legacy code, and why vulnerability scanners need to reason instead of following rules. Mehul's closing argument is that AI-native offense needs AI-native defense.